# Best practice with Logstash output and ES

**URL:** https://discuss.elastic.co/t/best-practice-with-logstash-output-and-es/95189
**Category:** Logstash
**Created:** [July 31, 2017, 1:02pm UTC](https://discuss.elastic.co/t/best-practice-with-logstash-output-and-es/95189 "2017-07-31T13:02:30Z")
**Posts on this page:** 1
**Showing post:** 3

<div class="post-metadata">

### Author: ![lendoly](https://avatars.discourse-cdn.com/v4/letter/l/439d5e/32.png) [@lendoly](https://discuss.elastic.co/u/lendoly)
#### Post date: [August 2, 2017, 1:23pm UTC](https://discuss.elastic.co/t/best-practice-with-logstash-output-and-es/95189/3 "2017-08-02T13:23:11Z")

</div>

The idea is growth it to 2 masters nodes, 4 ingest nodes and 4 data nodes, but for now with this cluster is enough to handle the actual volume of data (yeah, I know that the replication is not working good now because we only have 1 data node, the first thing that we will add will be other data node), that's why I was trying to make it works with this structure.

So basically I was right, Logstash needs to send the data directly to the ingest nodes, isn't it? and any way to balance the load? I was thinking to put all the ingest nodes behind a load balancer for the Logstash, but not sure if this will work well.

---

_[View the full topic](https://discuss.elastic.co/t/best-practice-with-logstash-output-and-es/95189)._